Spec a safe filename check for uploads

Your Python service saves each upload to /srv/uploads/<user_id>/, using the filename the browser sent. A coding agent will write is_safe_filename(name), which decides whether that name may be used on disk. A penetration test last year got a file written outside the user's folder.

Write the spec you would hand the agent.

What you know:

• the server runs Linux, and files are served back later for download
• people upload names like résumé.pdf, Q3 report (final).xlsx and names in Japanese
• the team wants the check written with Python's re module
• the app must still show the original name, even when the stored name differs

Then, in a few sentences: what does "regex to validate a safe filename" get wrong?